Re: Snort 1.9 vs 2.0

[Erek Adams <erek () theadamsfamily net>]

On 11 Oct 2002, Florin Andrei wrote:

> Excellent! Kudos to everyone at Sourcefire!

Absolutely!!  :)

> Now, remember my question at your talk a few months ago in Silicon
> Valley? ;-) Are we going to get reliable full SQL logging?

Ummm...  Snort has that already.  :)

> Including portscan data? That was my biggest problem with Snort 1.8 - some
> portscan-related information never made it to the database, but only to the
> text log.

Well....  Due to the way spp_portcan.c and spp_portscan2.c are written, you
can't do this right now.  It would require a full rewrite (or at least a lot
of changes) to the code.  Until that happens, you may not get all of your data
from the scans into the DB that you want.

:(  Sorry....

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users